Pinning an action to a SHA rather than a tag

A tag is a mutable pointer in somebody else’s repository, and a workflow referencing one runs whatever that pointer names today.

# mutable — v3 moves, and can be moved backwards
- uses: actions/checkout@v3

# immutable
- uses: actions/checkout@8f4b7f8 # v3.0.2

# the comment is not decoration: without it, nobody can
# tell what version this is or whether it is current.

This matters most for third-party actions, which run with access to the workspace and any secrets the step is given. Pinning everything by SHA is the correct position and produces a maintenance burden that only a bot makes tolerable — Dependabot updates action SHAs and rewrites the comment, which is the arrangement that actually survives. For actions published by the platform itself the risk is lower and the argument is weaker, and drawing the line at “anything not from GitHub” is a defensible policy to write down.